CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-28359?
CVE-2021-28359 is a vulnerability in Apache Airflow that allows for XSS exploits through the 'origin' parameter passed to endpoints like '/trigger'.
Which versions of Apache Airflow are affected by CVE-2021-28359?
CVE-2021-28359 affects Apache Airflow versions <1.10.15 in the 1.x series and versions 2.0.0, 2.0.1, and 2.x series.
How severe is CVE-2021-28359?
CVE-2021-28359 has a severity rating of 6.1 (medium).
How can CVE-2021-28359 be exploited?
CVE-2021-28359 can be exploited through an XSS (Cross-Site Scripting) attack by manipulating the 'origin' parameter in certain endpoints like '/trigger'.
Is there a fix available for CVE-2021-28359?
Yes, you can mitigate CVE-2021-28359 by updating Apache Airflow to version 1.10.15 for the 1.x series or version 2.0.2 for the 2.x series.